From 8615e2c8e5a0964b871282582127e4a6aad763a5 Mon Sep 17 00:00:00 2001
From: Grissiom <chaos.proton@gmail.com>
Date: Tue, 14 Oct 2014 16:00:42 +0800
Subject: [PATCH 1/5] kernel/timer: change row_lvl to unsigned

Use signed int as array index is unsecure.
---
 src/timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/timer.c b/src/timer.c
index f71e40fcd6..ba2801530d 100644
--- a/src/timer.c
+++ b/src/timer.c
@@ -293,7 +293,7 @@ RTM_EXPORT(rt_timer_delete);
  */
 rt_err_t rt_timer_start(rt_timer_t timer)
 {
-    int row_lvl;
+    unsigned int row_lvl;
     rt_list_t *timer_list;
     register rt_base_t level;
     rt_list_t *row_head[RT_TIMER_SKIP_LIST_LEVEL];

From 23cc390474f35bf6a331eff8c498b47e44835574 Mon Sep 17 00:00:00 2001
From: Grissiom <chaos.proton@gmail.com>
Date: Tue, 14 Oct 2014 16:07:19 +0800
Subject: [PATCH 2/5] msh: check path is non-null in msh_auto_complete_path

---
 components/finsh/msh.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/finsh/msh.c b/components/finsh/msh.c
index a976705857..02cbeea196 100644
--- a/components/finsh/msh.c
+++ b/components/finsh/msh.c
@@ -358,6 +358,9 @@ void msh_auto_complete_path(char *path)
     struct dirent *dirent = RT_NULL;
     char *full_path, *ptr, *index;
 
+    if (!path)
+        return;
+
     full_path = (char*)rt_malloc(256);
     if (full_path == RT_NULL) return; /* out of memory */
 

From 4c39f8765ac20bd43488484dd3e526de792e5d5e Mon Sep 17 00:00:00 2001
From: Grissiom <chaos.proton@gmail.com>
Date: Tue, 14 Oct 2014 16:07:49 +0800
Subject: [PATCH 3/5] msh: free is only available when HEAP is enabled

---
 components/finsh/msh_cmd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/finsh/msh_cmd.c b/components/finsh/msh_cmd.c
index 0ec0b07621..ca92ef7a6d 100644
--- a/components/finsh/msh_cmd.c
+++ b/components/finsh/msh_cmd.c
@@ -276,6 +276,7 @@ int cmd_time(int argc, char** argv)
 }
 FINSH_FUNCTION_EXPORT_ALIAS(cmd_time, __cmd_time, Execute command with time.);
 
+#ifdef RT_USING_HEAP
 int cmd_free(int argc, char** argv)
 {
     extern void list_mem(void);
@@ -284,6 +285,7 @@ int cmd_free(int argc, char** argv)
     return 0;
 }
 FINSH_FUNCTION_EXPORT_ALIAS(cmd_free, __cmd_free, Show the memory usage in the system.);
+#endif
 
 #endif
 

From 9a755833492a6a81045d987ba44fd7f105d489c3 Mon Sep 17 00:00:00 2001
From: Grissiom <chaos.proton@gmail.com>
Date: Tue, 14 Oct 2014 16:09:10 +0800
Subject: [PATCH 4/5] dfs: check for null reference

---
 components/dfs/src/dfs_file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/dfs/src/dfs_file.c b/components/dfs/src/dfs_file.c
index f5619e2354..614a349494 100644
--- a/components/dfs/src/dfs_file.c
+++ b/components/dfs/src/dfs_file.c
@@ -335,6 +335,9 @@ int dfs_file_lseek(struct dfs_fd *fd, rt_off_t offset)
 
     if (fd == RT_NULL)
         return -DFS_STATUS_EINVAL;
+    fs = fd->fs;
+    if (fs == RT_NULL)
+        return -DFS_STATUS_EINVAL;
     if (fs->ops->lseek == RT_NULL)
         return -DFS_STATUS_ENOSYS;
 

From e03045122053ab8bc1422e03ae723db9ac7ffa98 Mon Sep 17 00:00:00 2001
From: Grissiom <chaos.proton@gmail.com>
Date: Tue, 14 Oct 2014 16:14:02 +0800
Subject: [PATCH 5/5] minilibc: only define malloc family when RT_USING_HEAP
 enabled

---
 components/libc/minilibc/stdlib.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/libc/minilibc/stdlib.c b/components/libc/minilibc/stdlib.c
index 51cb07fee0..e29ae9bc2e 100644
--- a/components/libc/minilibc/stdlib.c
+++ b/components/libc/minilibc/stdlib.c
@@ -54,6 +54,7 @@ long int atol(const char* s)
 	return sign?-v:v;
 }
 
+#ifdef RT_USING_HEAP
 void *malloc(size_t size)
 {
 	return rt_malloc(size);
@@ -73,5 +74,6 @@ void *calloc(size_t nelem, size_t elsize)
 {
 	return rt_calloc(nelem, elsize);
 }
+#endif
 
 #endif